# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=618 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 619 --- ## [Write thread pool queue size defaults](https://discuss.elastic.co/t/write-thread-pool-queue-size-defaults/277449)
**Author:** [@Alex\_Abdulin](https://discuss.elastic.co/u/Alex_Abdulin)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 3:12pm UTC](https://discuss.elastic.co/t/write-thread-pool-queue-size-defaults/277449 "2021-06-30T15:12:05Z")
Hello, everyone! I'm tuning ES 6.8 for indexing performance and noticed one interesting thing. There is a significant difference in the default value of the q size in versions 6.8 and 7.x. The documentation states: ES … --- ## [Create a new HOME LOAN index using the file homeloan\_index.json](https://discuss.elastic.co/t/create-a-new-home-loan-index-using-the-file-homeloan-index-json/277248)
**Author:** [@BalakN](https://discuss.elastic.co/u/BalakN)\ **Replies:** 6\ **Last updated:** [June 30, 2021, 12:35pm UTC](https://discuss.elastic.co/t/create-a-new-home-loan-index-using-the-file-homeloan-index-json/277248 "2021-06-30T12:35:35Z")
I'm completely new to ELK and how to complete the following requirement. Create a new index "TEST-LOAN-INDEX" in QA environment using the json file "loan\_index.json" . --- ## [Index lifecycle policy - warm phase not readonly](https://discuss.elastic.co/t/index-lifecycle-policy-warm-phase-not-readonly/275698)
**Author:** [@calauzon\_genetec](https://discuss.elastic.co/u/calauzon_genetec)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 12:14pm UTC](https://discuss.elastic.co/t/index-lifecycle-policy-warm-phase-not-readonly/275698 "2021-06-30T12:14:08Z")
Hello, I am confused about an index I created. I have a template, which uses a lifecycle policy as follows: { "policy": { "phases": { "hot": { "actions": { "set\_priority": { "p… --- ## [How to add Windows service name in the alert](https://discuss.elastic.co/t/how-to-add-windows-service-name-in-the-alert/277451)
**Author:** [@Manan](https://discuss.elastic.co/u/Manan)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 11:27am UTC](https://discuss.elastic.co/t/how-to-add-windows-service-name-in-the-alert/277451 "2021-06-30T11:27:38Z")
Hi, I am monitoring windows services and using metricbeat 7.12. I have created an alert which works fine. But I would like to add name of the service in the alert message. How can I add the service name in the alert … --- ## [How to display 0 count field values in Elastic DSL Query](https://discuss.elastic.co/t/how-to-display-0-count-field-values-in-elastic-dsl-query/275137)
**Author:** [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 8:43am UTC](https://discuss.elastic.co/t/how-to-display-0-count-field-values-in-elastic-dsl-query/275137 "2021-06-30T08:43:32Z")
All, I am trying to find out a way to display input field values in Elastic watcher which are having 0 count records. For example my input fields and values are hostname=sample.com and source=/tmp/sample/log I am usin… --- ## [Search/Filter on exact keyword with email value](https://discuss.elastic.co/t/search-filter-on-exact-keyword-with-email-value/277425)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 8:30am UTC](https://discuss.elastic.co/t/search-filter-on-exact-keyword-with-email-value/277425 "2021-06-30T08:30:54Z")
We cannot find documents with an email keyword exact match. Other keywords work so I guess it's the @ symbol. How do we /\_search documents with exact keyword match I thought keywords worked with exact match only (no to… --- ## [Elasticsearch-browser not connecting to remote server](https://discuss.elastic.co/t/elasticsearch-browser-not-connecting-to-remote-server/277417)
**Author:** [@ayush28j](https://discuss.elastic.co/u/ayush28j)\ **Replies:** 1\ **Last updated:** [June 30, 2021, 7:32am UTC](https://discuss.elastic.co/t/elasticsearch-browser-not-connecting-to-remote-server/277417 "2021-06-30T07:32:58Z")
Hello everyone, I have a elasticsearch server running on google compute engine at port 9200 with no problems in firewalls. When I run this curl command: curl -u elastic:passwordChanged -H "User-Agent: Mozilla" -H "Ori… --- ## [Elasticsearch CCR. Role mappings](https://discuss.elastic.co/t/elasticsearch-ccr-role-mappings/277413)
**Author:** [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Replies:** 0\ **Last updated:** [June 30, 2021, 6:25am UTC](https://discuss.elastic.co/t/elasticsearch-ccr-role-mappings/277413 "2021-06-30T06:25:48Z")
I configured Elasticsearch to work with mutual TLS authentication and authorization is done using pki realm. While replication data between clusters (CCR) it uses transport layer, I have the same CA on both clusters, so… --- ## [Shrinked ip address field](https://discuss.elastic.co/t/shrinked-ip-address-field/277376)
**Author:** [@roonick](https://discuss.elastic.co/u/roonick)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 4:39am UTC](https://discuss.elastic.co/t/shrinked-ip-address-field/277376 "2021-06-30T04:39:47Z")
Good day! I want to create additional field for nginx access log. This field must contain left octets of IP-address. For examle. If remote IP is 192.168.1.10, field will contain only 192.168.1. Sorry, my English is not… --- ## [How to run elasticsearch-head permanently](https://discuss.elastic.co/t/how-to-run-elasticsearch-head-permanently/277320)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 2\ **Last updated:** [June 30, 2021, 12:49am UTC](https://discuss.elastic.co/t/how-to-run-elasticsearch-head-permanently/277320 "2021-06-30T00:49:14Z")
I've cloned git and installed elasticsearch-head. I've been running it in the background while the terminal is running, but I want to keep it running after I close the terminal. I ran the following command, but when I … --- ## [Help with handling errors sent by api](https://discuss.elastic.co/t/help-with-handling-errors-sent-by-api/276421)
**Author:** [@Agustin\_Fernandez](https://discuss.elastic.co/u/Agustin_Fernandez)\ **Replies:** 7\ **Last updated:** [June 29, 2021, 10:42pm UTC](https://discuss.elastic.co/t/help-with-handling-errors-sent-by-api/276421 "2021-06-29T22:42:00Z")
Hi! I am needing help with the rest api schema. I want to make my program send the data to elastic but that it can be seen as is this example. The code that I had thought to use was this { "mappings": { … --- ## [No matching indices found: No indices match pattern “winlogbeat-\*”](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern-winlogbeat/277300)
**Author:** [@Shivam\_Kalra2](https://discuss.elastic.co/u/Shivam_Kalra2)\ **Replies:** 3\ **Last updated:** [June 29, 2021, 10:04pm UTC](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern-winlogbeat/277300 "2021-06-29T22:04:26Z")
Hello, I am getting the errors "No matching indices found: No indices match pattern "winlogbeat-\*" when I try to go to the Winlogbeat dashboard or Discover. There was a winlogbeat-\* index pattern created, just no traffi… --- ## [Ingest pipeline "Failed to parse content to map"](https://discuss.elastic.co/t/ingest-pipeline-failed-to-parse-content-to-map/276812)
**Author:** [@Louis1](https://discuss.elastic.co/u/Louis1)\ **Replies:** 6\ **Last updated:** [June 29, 2021, 2:05pm UTC](https://discuss.elastic.co/t/ingest-pipeline-failed-to-parse-content-to-map/276812 "2021-06-29T14:05:35Z")
Why is this log causing an error and what is the meaning of "Failed to parse content to map". I am pretty new to pipelines and ES in general so any help would be greatly appreciated: INPUT POST \_ingest/pipeline/\_simula… --- ## [How to split array or string with "Ingest Node Pipeline"](https://discuss.elastic.co/t/how-to-split-array-or-string-with-ingest-node-pipeline/277052)
**Author:** [@HaKuNa](https://discuss.elastic.co/u/HaKuNa)\ **Replies:** 2\ **Last updated:** [June 29, 2021, 12:23pm UTC](https://discuss.elastic.co/t/how-to-split-array-or-string-with-ingest-node-pipeline/277052 "2021-06-29T12:23:33Z")
Hi I'm new to ECE and have a filebeat pipeline which sends data to ECE. This is the format of the message field which I have in ECE (separator would be -\> \\t): 2021-06-25T13:08:39.559+0200 INFO 12409 com.l7tech.tra… --- ## [Elastic Score differs in search vs explain](https://discuss.elastic.co/t/elastic-score-differs-in-search-vs-explain/277345)
**Author:** [@Mohammed\_Ajil](https://discuss.elastic.co/u/Mohammed_Ajil)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 11:57am UTC](https://discuss.elastic.co/t/elastic-score-differs-in-search-vs-explain/277345 "2021-06-29T11:57:59Z")
--- ## [Cross cluster replication security. Mutual TLS query](https://discuss.elastic.co/t/cross-cluster-replication-security-mutual-tls-query/277340)
**Author:** [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 11:47am UTC](https://discuss.elastic.co/t/cross-cluster-replication-security-mutual-tls-query/277340 "2021-06-29T11:47:31Z")
ClusterA (leader) keystore (includes server certificate with principal cn=ClusterA, signed by company CA) truststore (company CA) ClusterB (follower) keystore (includes server certificate with principal cn=ClusterB, … --- ## [How to get kibana time range filter value on a Scripted metric aggregation](https://discuss.elastic.co/t/how-to-get-kibana-time-range-filter-value-on-a-scripted-metric-aggregation/277330)
**Author:** [@ayanam](https://discuss.elastic.co/u/ayanam)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 9:52am UTC](https://discuss.elastic.co/t/how-to-get-kibana-time-range-filter-value-on-a-scripted-metric-aggregation/277330 "2021-06-29T09:52:18Z")
Hi, I'm trying to retrieve the min and max of the time range set on kibana in a scripted metric aggregation (in the reduce\_script part), if anyone has an idea on how to achieve this. --- ## [Performance impact of changing number\_of\_replicas on a live index](https://discuss.elastic.co/t/performance-impact-of-changing-number-of-replicas-on-a-live-index/277191)
**Author:** [@ghallas](https://discuss.elastic.co/u/ghallas)\ **Replies:** 1\ **Last updated:** [June 29, 2021, 9:21am UTC](https://discuss.elastic.co/t/performance-impact-of-changing-number-of-replicas-on-a-live-index/277191 "2021-06-29T09:21:12Z")
Hello, I have a cluster with 3 master nodes and 9 data nodes. My main index has 3 shards, and number\_of\_replicas:1 . It also has some 5 million documents, and receives around 30 requests per second. Data node CPU util… --- ## [Watcher: comparing two fields from different indexes](https://discuss.elastic.co/t/watcher-comparing-two-fields-from-different-indexes/276699)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 4\ **Last updated:** [June 29, 2021, 9:00am UTC](https://discuss.elastic.co/t/watcher-comparing-two-fields-from-different-indexes/276699 "2021-06-29T09:00:11Z")
Hi, Im running a chained input watch with two queries: "first" and "second", and comparing the fields partition\_field\_value from "first" against hostname from "second", Im certain that in both indexes exist a partition\_… --- ## [Unable to get new logstash data after using DELETE /logstash](https://discuss.elastic.co/t/unable-to-get-new-logstash-data-after-using-delete-logstash/277309)
**Author:** [@vikram.sablok](https://discuss.elastic.co/u/vikram.sablok)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 7:41am UTC](https://discuss.elastic.co/t/unable-to-get-new-logstash-data-after-using-delete-logstash/277309 "2021-06-29T07:41:13Z")
Unable to get new logstash data after using DELETE /logstash. The data is fetched from logstash using JDBC to logstash however this is not visible in Kibana --- ## [Elasticsearch mapping](https://discuss.elastic.co/t/elasticsearch-mapping/277303)
**Author:** [@kanchan\_thakur](https://discuss.elastic.co/u/kanchan_thakur)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 7:32am UTC](https://discuss.elastic.co/t/elasticsearch-mapping/277303 "2021-06-29T07:32:03Z")
Hi, I am using User dictionary rules in Kuromoji tokenizer in ES mapping. When I am feeding my data to Elasticsearch cluster it mapped some of the keywords strangely like keyword 禰󠄀豆子. I got that ES normalizes the … --- ## [L32sv2 vs DS5v2 on Azure](https://discuss.elastic.co/t/l32sv2-vs-ds5v2-on-azure/277083)
**Author:** [@porscheme](https://discuss.elastic.co/u/porscheme)\ **Replies:** 6\ **Last updated:** [June 29, 2021, 6:31am UTC](https://discuss.elastic.co/t/l32sv2-vs-ds5v2-on-azure/277083 "2021-06-29T06:31:15Z")
For deploying huge Elasticsearch which Azure VM SKU is better? DS5v2 – Intel Xeon processor RAM: 56 GB vCPU(s): 16 Managed Disk: Premium SSD L32s v2: AMD EPYC 7551 processor RAM: 256 GB vCPU(s): 32 Local NVMe pre… --- ## [How can I sort String with has\_parent in ElasticSearch](https://discuss.elastic.co/t/how-can-i-sort-string-with-has-parent-in-elasticsearch/277289)
**Author:** [@ryo](https://discuss.elastic.co/u/ryo)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 6:07am UTC](https://discuss.elastic.co/t/how-can-i-sort-string-with-has-parent-in-elasticsearch/277289 "2021-06-29T06:07:17Z")
I use has\_parent for query data, but I want to sort this data follow some parent field which is a String . I tried to find solutions, I found how to sort in ElasticSearch documents "query": { "has\_parent" : { … --- ## [InnerHitBuilder field query](https://discuss.elastic.co/t/innerhitbuilder-field-query/277280)
**Author:** [@111487](https://discuss.elastic.co/u/111487)\ **Replies:** 0\ **Last updated:** [June 29, 2021, 3:56am UTC](https://discuss.elastic.co/t/innerhitbuilder-field-query/277280 "2021-06-29T03:56:27Z")
I have some questions.in the InnerHitBuilder field query , Can I support custom queries for Innerhitbuilder field queries? --- ## [Planned total network page - how will the cluster react?](https://discuss.elastic.co/t/planned-total-network-page-how-will-the-cluster-react/277235)
**Author:** [@ankh](https://discuss.elastic.co/u/ankh)\ **Replies:** 4\ **Last updated:** [June 29, 2021, 3:10am UTC](https://discuss.elastic.co/t/planned-total-network-page-how-will-the-cluster-react/277235 "2021-06-29T03:10:07Z")
We have a planned network outage for 8 hours that will stop communication between all hosts, including between nodes in our elastic cluster. We have 3 master nodes and 2 minimum master nodes set. Using logstash to write… --- ## [How to make elasticsearch returns products from stores that deliver to the user's region?](https://discuss.elastic.co/t/how-to-make-elasticsearch-returns-products-from-stores-that-deliver-to-the-users-region/277234)
**Author:** [@ironzep](https://discuss.elastic.co/u/ironzep)\ **Replies:** 1\ **Last updated:** [June 29, 2021, 2:01am UTC](https://discuss.elastic.co/t/how-to-make-elasticsearch-returns-products-from-stores-that-deliver-to-the-users-region/277234 "2021-06-29T02:01:06Z")
I am struggling with this for a time. The scenario is the following: I have an elasticsearch index which has products and each product has a store. The store has fields that store its latitude, longitude and the max dist… --- ## [I can't do any snapshot related task due to error "No space left on device"](https://discuss.elastic.co/t/i-cant-do-any-snapshot-related-task-due-to-error-no-space-left-on-device/277258)
**Author:** [@valleram](https://discuss.elastic.co/u/valleram)\ **Replies:** 1\ **Last updated:** [June 29, 2021, 1:39am UTC](https://discuss.elastic.co/t/i-cant-do-any-snapshot-related-task-due-to-error-no-space-left-on-device/277258 "2021-06-29T01:39:28Z")
Hi All, The snapshot repository I've registered on my cluster is full. I've being trying to delete some of older snapshots but I keep receiving "No Space left on device" error message. I tried deleting them directly t… --- ## [Shard Allocation Failures After 5 Retries](https://discuss.elastic.co/t/shard-allocation-failures-after-5-retries/276969)
**Author:** [@xianhechen](https://discuss.elastic.co/u/xianhechen)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 11:54pm UTC](https://discuss.elastic.co/t/shard-allocation-failures-after-5-retries/276969 "2021-06-28T23:54:03Z")
Hi, We have a 23 nodes cluster with 5 master nodes, 3 coordinator nodes, and 15 data nodes. Our index has a total of 30 primary shards and 3 replicas. Size of the index is around 800Gb. Earlier this week we found that t… --- ## [Figure out shard size from size before creating Elasticsearch index in python](https://discuss.elastic.co/t/figure-out-shard-size-from-size-before-creating-elasticsearch-index-in-python/276302)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 3\ **Last updated:** [June 28, 2021, 9:45pm UTC](https://discuss.elastic.co/t/figure-out-shard-size-from-size-before-creating-elasticsearch-index-in-python/276302 "2021-06-28T21:45:32Z")
Hi, We need to know the size of each shard before creating an index in ES. We are using Hail python library, and have MatrixTable that we convert to Table, and then write to Elasticsearch: mt = mt.rows() # Converts ne… --- ## [Which node to connect to](https://discuss.elastic.co/t/which-node-to-connect-to/276408)
**Author:** [@Bo-Wyatt](https://discuss.elastic.co/u/Bo-Wyatt)\ **Replies:** 3\ **Last updated:** [June 28, 2021, 7:55pm UTC](https://discuss.elastic.co/t/which-node-to-connect-to/276408 "2021-06-28T19:55:55Z")
Hello, this is a dum question. But I have two nodes on my cluster (One is master). And I always use the master IP (or URL) to fetch for Info, for example in my Grafana data source I use the Node1 URL to Connect. Is alwa… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=617) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=619)